Insufficient access control for password reset in sftpgo
CVE-2024-37897

5.4MEDIUM

Key Information:

Vendor

Drakkan

Status
Sftpgo
Vendor
CVE Published:
20 June 2024

What is CVE-2024-37897?

SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient support password reset. This feature is disabled in the default configuration. In SFTPGo versions prior to v2.6.1, if the feature is enabled, even users with access restrictions (e.g. expired) can reset their password and log in. Users are advised to upgrade to version 2.6.1. Users unable to upgrade may keep the password reset feature disabled or set a blank email address for users and admins with access restrictions so they cannot receive the email with the reset code and exploit the vulnerability.

Affected Version(s)

sftpgo >= 2.2.0, < 2.6.1

References

https://github.com/drakkan/sftpgo/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.